Where WireGuard came from
WireGuard was created by security researcher Jason A. Donenfeld, who started the project around 2015–2016 out of frustration with the two dominant VPN options at the time: IPsec, which he found bloated and difficult to configure correctly, and OpenVPN, which was flexible but ran in userspace and carried the performance overhead that comes with it. He set out to write something different — a VPN that could live inside the Linux kernel itself, with a codebase small enough for a single engineer to read and verify.
The result, first published in 2016, was startling in its size: roughly 4,000 lines of code, compared to hundreds of thousands in OpenVPN or the IPsec stack. Linus Torvalds, not known for handing out compliments lightly, called it "a work of art" compared to the alternatives. It was merged into the mainline Linux kernel in 2020.
How it actually works
WireGuard doesn't negotiate ciphers the way older protocols do. Instead of offering a menu of algorithms that both ends have to agree on — a process that's historically been a source of downgrade attacks — it hard-codes one modern, opinionated set: Curve25519 for key exchange, ChaCha20 for encryption, Poly1305 for authentication, and BLAKE2s for hashing. If you want different cryptography, you use a different version of WireGuard; the protocol itself doesn't negotiate.
Its handshake is built on the Noise Protocol Framework, a modern toolkit for building secure handshakes that predates and heavily influenced protocols like Signal's. The handshake completes in a single round trip, keys rotate automatically every two minutes, and — notably — WireGuard has no concept of connection state the way TCP-based VPNs do. Interfaces simply associate a public key with an IP address; if your network changes (Wi-Fi to LTE, for instance), the tunnel just keeps working without a visible reconnect.
WireGuard's speed and simplicity come from being opinionated about what it is: a fast, minimal tunnel. Out of the box it has a very recognizable packet structure, which makes it easy for deep packet inspection to identify — this is why circumvention-focused deployments typically wrap WireGuard traffic in an obfuscation layer rather than exposing it directly.
WireGuard vs. OpenVPN
| Property | OpenVPN | WireGuard |
|---|---|---|
| Codebase size | ~600,000 lines | ~4,000 lines |
| Runs in | Userspace | Kernel (or fast userspace) |
| Cipher negotiation | Configurable (TLS-based) | Fixed, modern suite |
| Handshake speed | Multiple round trips | Single round trip |
| Default stealth | Moderate | Low — needs obfuscation wrapper |
Where you'll encounter it
WireGuard is now the underlying engine for a large share of modern VPN services, including well-known consumer products that rebrand it (NordVPN's "NordLynx" and Mullvad's default configuration are both built on WireGuard). Its speed advantage is largest on mobile and lower-power devices, where the overhead of older userspace protocols is most noticeable.
MiTiVPN's multi-hop routing core is WireGuard-based for exactly this reason — but it's never exposed directly. Every WireGuard tunnel is wrapped in the same obfuscation layer used for VLESS traffic, so the speed advantage doesn't come at the cost of a detectable fingerprint.